Candidate Privacy Notice

August 2026

information about you during recruitment in accordance with applicable data protection law, including the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

1. Who we are and when this notice applies

   Salad Finance Limited (Salad, we, us or our) is the data controller for personal information used in recruitment. Our registered office is 49 Greek Street, London, United Kingdom W1D 4EG and our ICO registration number is ZA426089.

   This notice applies when you apply for a role, are approached about a role, take part in an interview or assessment, provide information for checks, or apply internally. If you join us, relevant information will move to your personnel or regulatory record and the applicable workforce privacy information will apply.

2. Information we collect and where it comes from

   Depending on the role and recruitment stage, we may collect:

   • contact details, CV, application, employment and education history, qualifications, skills, work samples, salary expectations, availability and working-location preferences;
   • interview and assessment information, including notes, scores, correspondence and Microsoft Teams meeting information;
   • reasonable-adjustment information, voluntary equality-monitoring information, identity and right-to-work evidence, references and verification information;
   • for relevant roles, consumer credit report and electoral roll information, regulatory checks, UK criminal-record information (Basic Disclosure), and international credit, criminal-record and regulatory information; and
   • recruitment-portal and system-security information, plus other information reasonably required for an explained recruitment purpose.

   We obtain most information from you. We may also receive it from recruitment agencies, referees, previous employers, professional or educational bodies, the Home Office, approved verification and screening providers, credit-reference agencies, electoral roll and other public records, the Disclosure and Barring Service, the FCA and other UK or overseas regulators, criminal-record authorities, official registers, publicly available professional sources, or our own records if you already work for us. If information comes from another source, we will normally provide this notice at first contact or within the period required by law.

3. How and why we use information

   We use recruitment information only where we have a lawful basis. The main purposes and bases are summarised below.

   Purpose	Examples of information used	Main lawful basis
   Manage applications and communicate	Contact details, CV, application and correspondence	Pre-contract steps; legitimate interests
   Assess suitability and select candidates	Experience, qualifications, interviews, tests, scores and notes	Pre-contract steps; legitimate interests
   Arrange adjustments and accessible recruitment	Adjustment requests and relevant health or disability information	Legal obligations; substantial employment-law interests
   Make an offer and complete checks	Identity, references, qualifications, right-to-work, consumer credit, electoral roll, criminal-record and regulatory information	Pre-contract steps; legal obligations; legitimate interests
   Monitor equality of opportunity	Voluntary equality-monitoring information	Legitimate interests; substantial public interest
   Protect systems, prevent fraud and handle claims	Security logs, identity information and recruitment records	Legitimate interests; legal obligations
   Contact you about future roles where agreed	Contact details, CV, skills and preferences	Consent or legitimate interests, as explained

   Our legitimate interests include recruiting suitable people fairly and efficiently, maintaining a capable and trustworthy workforce, protecting candidates and systems, meeting regulated-business expectations and establishing or defending legal claims. We balance those interests against your rights. Where we rely on consent, you may withdraw it at any time.

4. Sensitive information, checks and recruitment technology

   Health or disability information may be used to arrange reasonable adjustments, meet employment-law duties or assess an intrinsic role requirement where lawful. Equality-monitoring information is kept separate from selection wherever practicable and is normally used only in aggregate.

   Where appropriate for the role and permitted by law, an approved external screening provider may carry out one or more of the following checks: Consumer Credit Report, Electoral Roll, Regulatory Check, UK Criminal Record Check - Basic Disclosure, International Credit, International Criminal Record and International Regulatory. We will tell you which checks apply before screening begins. Criminal-offence and other vetting information is used only where the role and law permit or require it. For relevant FCA-regulated roles, the results may support regulatory approval or a fitness and propriety assessment. Salad remains responsible for interpreting the results and making the recruitment decision.

   Approved technology may help organise applications, schedule interviews or support human assessment. We do not make decisions producing legal or similarly significant effects solely by automated means unless we tell you in advance and provide the required safeguards. Microsoft Teams recording, transcription and AI meeting-assistant features are not normally used in interviews; if proposed, we will explain the purpose and use beforehand.

5. Who we share information with and international transfers

   Access within Salad is limited to people who need the information for recruitment, employment, legal, security or regulatory purposes, such as HR, hiring managers, interviewers, Compliance, Legal, Finance, Information Security and IT support.

   Where necessary, we may share information with recruitment agencies, assessment and recruitment-platform providers, Microsoft and other approved business-system providers, screening and verification providers and their approved information sources, credit-reference agencies, referees, previous employers, professional bodies, the FCA, the Home Office, the Disclosure and Barring Service, courts, regulators, law-enforcement bodies, professional advisers and other parties where the law permits or requires it. Service providers must protect information and use it only for authorised purposes.

   Some providers may process information outside the United Kingdom. Where required, we use an approved transfer safeguard and carry out any necessary risk assessment. Further information about a relevant transfer is available on request.

6. How long we keep information and how we protect it

   We keep information only for as long as needed, taking account of legal, regulatory, operational and claims-related requirements:

   • unsuccessful-candidate records are normally kept for 12 months after the process ends, then deleted or anonymised unless a longer period is justified;
   • talent-pool information is normally refreshed or deleted after 12 months, unless a different period is explained;
   • information needed for a successful candidate is transferred to the appropriate personnel or regulatory record;
   • detailed vetting material is deleted when no longer needed, while a proportionate record of the check and outcome may be retained; and
   • right-to-work evidence is retained throughout employment and for two years afterwards.

   We use appropriate organisational and technical measures, including approved systems, restricted access, confidentiality duties, supplier controls, staff training and secure deletion. Please use the secure method specified when sending identity, right-to-work or other sensitive documents.

7. Providing information and your rights

   Some information, such as equality-monitoring data, is voluntary. Other information is needed to assess your application, communicate with you, make an offer or meet legal and regulatory duties. We will explain when information is required; without it, we may be unable to progress the application or confirm an offer.

   Depending on the circumstances, you may have rights to access, correct, erase or restrict your information; object to processing based on legitimate interests; receive certain information in a portable form; withdraw consent; and request human intervention in a qualifying solely automated decision. These rights are not absolute, and we may need to verify your identity before responding.

8. Contact, complaints and changes

   For recruitment questions or to exercise a data-protection right, contact HR using the details in the job advertisement, application portal or recruitment correspondence. You may also write to: Data Protection Lead, Salad Finance Limited, 49 Greek Street, London, United Kingdom W1D 4EG.

   We hope to resolve concerns directly. You may also complain to the Information Commissioner's Office, the UK data-protection regulator. We may update this notice to reflect changes in law, guidance, technology or recruitment practices. The current version will be available through our website, and we will highlight a material change affecting an active application where reasonably practical.